All servicesAI security audit

Find the gaps in your app's security.

We review exposed assets, private code and access rules with your approval, then help fix confirmed risks.

Checking availability...

Scan scope and terms

Only scan a site you own or have permission to check. We request the submitted page and up to eleven additional same-site candidates from public links and sitemaps, and include up to six pages in the report.

We read linked same-site scripts and source maps, plus npm scripts on jsDelivr and unpkg. Identified package names and versions go to OSV for advisory lookup. Captured pages may run in an isolated browser with other network requests blocked. Credential values are not returned in the report.

HTTPS is required. Localhost and private-network addresses are blocked. Code patterns require review before they can be called exploitable vulnerabilities. A clean result is not a security certification.

This check cannot assess private code, database permissions or signed-in access. Those belong in a scoped audit.

Need a deeper review? Explore the scoped audit.

What we review in a deeper audit

We start a security audit by agreeing which parts of your app to review and what access you approve. We inspect the relevant code, settings and account permissions, show you each confirmed risk and prioritize the fixes. We can implement and verify changes within the agreed scope.

For an AI-built app approaching launch, a live product with a security concern, or a team that needs a second review.

  • Public URL check
  • Scoped security audit
  • Fixes and verification

  • Secrets and credentials

    We check where keys and connection details are stored or exposed, then plan rotation and server-side storage where needed.

  • Authentication and access

    We check server-side access rules and use approved test accounts and data to verify who can see or change what.

  • Database and storage policies

    We inspect the database policies, grants, storage rules and functions you authorize us to review, including Supabase settings.

  • Findings and a fix plan

    We give you findings with evidence and an order for fixing them. If implementation is in scope, we make the changes and retest the affected paths.

Public check or scoped audit?

The free check shows what we can observe from public assets. A scoped audit can examine what a URL cannot reveal.

  • Pages and scripts

    Public URL check
    Automated checks within published limits
    Scoped audit
    Review the relevant public findings

  • Private source code

    Public URL check
    Not available
    Scoped audit
    Review code you provide access to

  • Database and access rules

    Public URL check
    Cannot verify from the URL
    Scoped audit
    Review approved configuration and test cases

  • Results and fixes

    Public URL check
    Report with suggested fixes
    Scoped audit
    Prioritized findings, agreed fixes and verification

How we work together

  1. Agree the scope

    We agree which systems to inspect, what access we need and which test accounts or data to use. A public report can help us start.

  2. Review the evidence

    We inspect the agreed code and settings, confirm what we can, and show you where each issue appears and what it could expose.

  3. Make the agreed fixes

    If fixes are in scope, we update the affected code or settings and plan how to deploy and recover them safely.

  4. Verify and hand over

    We retest the affected paths and hand over the changes, remaining gaps and checks for future releases.

Common questions

Does a clean public scan mean my app is secure?

No. The scanner reads public assets within its published limits. It cannot verify private code, database permissions or signed-in access, and it reports what was skipped or only partly checked.

Can you review an app built with Lovable, Bolt or Replit?

Yes. We review the deployed application and the code and configuration included in the scope. The builder used does not determine whether an app is secure.

What access does a deeper security audit need?

That depends on the questions being investigated. It can include source code, configuration and a test environment. We agree the access and test data before starting; the public checker itself needs only the URL and your permission.

Someone found my Supabase key. Do I need to rotate it?

First identify the key. An anon or publishable key is intended for public clients, with access controlled by policies. A secret or service_role key must not be exposed and should be rotated if leaked.

Can you fix the issues from a security audit?

Yes. Fixes can be part of the agreed scope, followed by verification of the affected paths. The report also records anything that remains untested or unresolved.

Explore related services

Need help closing the gaps?

Bring your scan report or tell us what concerns you. We'll scope the review and the fixes.

Book a 30-min call

or reach us at hello@phaseahead.ai